Strix
26.1K

CVE-2007-2372

UnknownEPSS 8.20%

Last modified

CVE-2007-2372 is a vulnerability of currently unknown severity. admin/send_mod.php in Gregory Kokanosky phpMyNewsletter 0.8 beta5 and earlier prints a Location header but does not exit when administrative credentials are missing, which allows remote attackers to compose an e-mail message via a post with the subject, message, format, and list_id fields; and send the message via a direct request for the MsgId value under admin/.. EPSS estimates a 8.20% chance of exploitation in the next 30 days.

Description

admin/send_mod.php in Gregory Kokanosky phpMyNewsletter 0.8 beta5 and earlier prints a Location header but does not exit when administrative credentials are missing, which allows remote attackers to compose an e-mail message via a post with the subject, message, format, and list_id fields; and send the message via a direct request for the MsgId value under admin/.

Metrics

EPSS Probability
8.20%

94.2th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

VendorProductVersions
Gregory KokanoskyPhpmynewsletter<= 0.8_beta_5

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2007-2372?
admin/send_mod.php in Gregory Kokanosky phpMyNewsletter 0.8 beta5 and earlier prints a Location header but does not exit when administrative credentials are missing, which allows remote attackers to compose an e-mail message via a post with the subject, message, format, and list_id fields; and send the message via a direct request for the MsgId value under admin/.
How severe is CVE-2007-2372?
Severity scoring for CVE-2007-2372 is pending analysis. The EPSS model estimates a 8.20% probability of exploitation in the next 30 days.
How do I fix CVE-2007-2372?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2007-2372?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST